Executive brief
A vulnerability in Rancher Manager allows users with 'Project Owner' permissions to escalate their privileges to gain control over the underlying host server. By modifying security settings on their assigned projects, these users can bypass container isolation to access sensitive host-level resources and potentially compromise the entire cluster. This could lead to unauthorized data access, service disruption, or full takeover of the infrastructure.
Technical details
A privilege escalation vulnerability exists in Rancher Manager due to over-privileged default permissions in the 'project-owner' role. The role incorrectly uses a wildcard (*) permission for project resources, which includes the 'updatepsa' verb. An attacker with Project Owner and Cluster Member access can modify Pod Security Admission (PSA) labels on namespaces to apply a 'privileged' profile. This allows the deployment of containers that bypass standard isolation boundaries, enabling container breakout and access to host-level resources. The issue is resolved in versions 2.12.10, 2.13.6, and 2.14.2 by explicitly defining allowed verbs and removing 'updatepsa' from the default role.
Affected products
- SUSE Rancher Manager >= 2.14.0, < 2.14.2; >= 2.13.0, < 2.13.6; >= 2.12.0, < 2.12.10
Timeline
- 2026-05-27: disclosed: Initial disclosure date
- 2026-06-29: advisory: NVD publication date
- 2026-07-01: patched: GitHub Advisory updated with patch information